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BEING WIRETAPPED IS NO JOKE. TODAY'S 
micro-miniaturized electronics have 
made it easy for anyone with a little 
know-how and willful attitude to tap 
your phone and invade your privacy. 
Whether you call it eavesdropping, 
phone tapping, radio interception, or 
covert operations, we'll show you 
how to hunt down those tiny bugs. 
Although there are many adver- 
tised gadgets that claim to locate clan- 
destine transmitters, licensed private 
investigators, with few exceptions, 
have neither the technical expertise 
nor background to properly use them. 
Consequently, more and more inves- 
tigators are turning to radio techni- 
cians who are knowledgeable in 
counter-surveillance technology. 
That’s why a competent radio tech- 
nician with an inquisitive mind and 
the proper equipment can make a sup- 
plemental income (perhaps $100+ 
per hour) by availing himself, his 
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Are you being bugged? 
Here's how to find RF 
bugging devivces that 
are invading your privacy. 


equipment, and his expertise to inves- 
tigators who are trying to locate clan- 
destine transmitters. 


Tools of the trade 

The first order of business is to have 
the right tools. But what are the right 
tools for detecting bugs that are posi- 
tioned by persons good at hiding 
them? Bar none, the most invaluable 
tool is a spectrum analyzer (spec-an). 
The one used by the author is an [FR 
model A7550, which becomes porta- 
ble when using its built-in Nickel 
Cadmium (Ni-Cd) battery—an essen- 
tial convenience. 

You'll also need a good receiver to 
scan the RF spectrum looking for the 
bug’s frequency. Many spec-ans have 
radio-scanner options (receivers) that 
are designed to be hooked up without 
modification. Now admittedly, $500 
dollars for that option might sound 
like a lot of money; but when you’re 
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talking about a $10,000 investment, if 
it’s not really that much. After all, 
you're trying to discern what type of 
intelligence is contained in a detected 
signal, you need a good receiver. Of 
tremendous benefit would be some 
kind of mixer, down converter, or pre- 
scaler to extend the receiver’s fre- 
quency range. 

For obvious reasons, it’s para- 
mount to tape-record the bugged au- 
dio; also, a first-rate direction-finder 
is necessary so you can track down 
and locate clandestine, or spurious 
emissions. 

Another option that is extremely 
useful is a General Purpose /nterface 
Bus (GPIB) interface with a plotter, 
which will allow you to make hard- 
copy two-color printouts of the sus- 
pect frequencies that you have dis- 
covered, or wish to document. The 
GPIB will interface the spec-an’s out- 
put to the plotter. 
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There: area lot of gizmos. that are 
advertised-on the market as.so-called 
“counter-intelligence. devices.”” ‘The 
author-is compelled to warn-you that 
most of the equipment. will not: per- 
form as.advertised, and the equipment 
that will perform is often unethically 
sold for 3 to 5:times the list. price— 
caveat emptor! 

If you think that you’re being 
bugged, you may be. desperate. for 
anything that advertises to solve your 
problem quickly. The false promise of 
those gizmos seems like a good risk. 
But wait a minute: That’s exactly what 
those unethical companies are de- 
pending on to motivate a sale! Don’t 
fall into their trap. There’s no. short- 
cut gizmo that can replace the proper 
test equipment in the hands of a 
qualified radio technician. 


Sleuthing 
Technicians make some of the best 
detectives in the world—no. kidding! 
They have to investigate why some- 
- thing doesn’t work and trace down the 
fault; that takes an inquisitive mind. 
And if one has.a good sense of busi- 
ness, there’s plenty of work in coun- 
ter-surveillance. ‘That’s because. pri- 
. wate. citizens are being illegally 
- bugged every day; not to mention all 
~ the industrial and foreign. espionage 
that seems. so. prevalent. in today’s 
world: Yes; indeed, when word gets 
- around that a technician knows how to 


_ ferret out phone-taps,.that person’s 


skills. will be in demand. 

Most people just aren’t aware of all 
the inexpensive devices that can’ be 
legally purchased to invade their pri- 
vacy. Figure | shows three tiny bugs 
that can hear everything you say. Al- 
though clandestine bugs can come in 
small packages, a willful intruder will 
“use what's handy ‘and what works. 


' Bugs range from sugar-cube: sized . 


“wireless microphones” for $20, to 


 candy-box sized ‘“‘wireless inter- 
coms,” and handhelds, that will al- 


low anyone within a half-mile radius 
to listen to every spoken word in your 
home. And you can bet that there are 
many. more sophisticated: and. much 
more expensive devices, too! Let’s 
face it; not. just anyone can find one of 
those cleverly hidden bugs in your 
home or office. It takes someone like 
a technician with expert knowledge of 
radio transmissions, having the skills 
and equipment needed to track down 
tiny radio bugs. 

Did you know that a perfectly legal 


FIG. 1—-THESE ARE CLANDESTINE radio 
bugs. In (a), a parasitic: phone-tap: is 
shown. .disassembled. In. (b),a Radio 
Shack FM-transmitter: (part No. 33-1076) 
can be conveniently dropped behind the 
cushion. of a. chair. In.(c), this tiny FM 
transmitter.can be hidden.in a kitchen 
cabinet. : 


(FCC registered) phone tap is avail- 


able from. many.:companies for only 


$25? That’s because there’s a big mar- . 


ket for bugging your own phone. Just 
think for a moment: At one time or 


-another haven’t you called some big- 


time attorney, or doctor, or insurance 


company, only to hear strange beep- 
tones or clicks. That’s right, you’re 


being recorded—and it’s all legal! 


Most people are under the impres-. 


sion that intercepting ‘your own. tele- 
phone:conversation, or recording the 


“conversion. without: beep tones, is il- 


legal. That simply.isn’t true! You 
don’t have to notify anyone that 


you're tapping your own phone. How. 


about that! And if you can buy a sim- 
ple phone-tap, so can acriminal out to 
victimize the average Joe. 


Bug frequency 
Let’s suppose:a client suspects a 


radio bug has been planted in his tele- 
phone. However, the client might lack 
the know-how to either disassemble 
the phone, or even tell the difference 
between a wiretap and. the normal 
telephone’s circuitry. It’s possible that 
the client has found a wiretap, but 
dosen’t know what todo. A common 
wiretap is shown in Fig I-a. It’s a 
“parasitic telephone transmitter” (not 
to be confused, with parasitic or. spu- 
rious emissions from a legal RF trans- 
mitter). 

The nomenclature. “parasitic” was 
derived from the fact that the bug 
steals power (as a parasite feeds on 
others). from the telephone company 
and, consequently, needs no external 
battery or antenna. Those devices:use 
the telephone’s own headset coil-cord 
and associated wiring as the antenna, 
and the 48-volt central-station battery 
for power (which drops to about 10 
volts. when the handset is off hook). 

Depending upon how the tiny 
phone-bug is designed and where it’s 
located, it.can be received:on- an FM 
radio, or other receiver, up to one-half 
mile.away. The beauty of that bug is 
that it can’t be detected. unless. it’s 
actually operating, which means. the 
phone. must be.-off-hook. “And _al- 
though. able to operate on virtually 
any frequency, it’s common to sand- 
wich the transmissions between high- 
powered FM-broadcast stations; that’s 
so they won’t create radio interference 
that would tip off the authorities. Be- 
sides, an FM transmission can. be te- 
ceived by any. inexpensive FM. car 
radio—usually sitting in front of, or 
nearby, the victim’s house or. busi- 
ness. 

Here’s a. step-by-step procedure 
using a spec-an.to make any bu g stand 
out like a sore thumb: 
Step 1: Set scan-width for the 88 MHz 


‘to 108 MHz FM broadcast spectrum. 


Step 2: Set bandwidth resolution to 3 
kHz. You will now have a factual dis- 
play of all electromagnetic radiations 
occurring in the 88 MHz to 108. MHz . 
frequency range. 
Step 3: Set the “peak hold” to cap- 
ture and store all legitimate signals 
that are on the air (sée Fig..2-a). 
Step 4: Digitally invert all stored in- 
formation (see Fig. 2-b). 
Step 5: Pick up the suspected tele- 
phone (off hook) and. you'll notice 
that the signal previously not present 
is now displayed (see Fig. 2-c). 

What we have accomplished. is.a_ 
digital cancellation of everything that 


should be on the air as a brand : 
ew signal that was not there prior to 
our picking up the phone, but which 


- now sticks out like a sore thumb. 

Incidentally, for evidence in court 
(and customer records) the plots that 
are reproduced can be made at the 


actual scene of the crime with the 
_ GPIB option (also known as. 
_ TEEE-488). One GPIB is available © 

_ fromIFR toconnecttheirspec-antoa 
Hewlett Packard 7ATCA Plotter. 


bug, the last thing n Ps world ie 
- you want is the bug to hear itself! (If 
_ the bug is active, i ' 


. Here’s what to do. 


‘sume that someone is listening.) to 
you have a receiver tuned to the bug 
ith speaker audio, and you get too 
close, you'll get audio feedback, 
_which will immediately tip offthe spy 

hat you're on te him! No good! oo 


Once the bug’s frequency: is found, 
use headphones with along, long, 
_ extension cord (maybe 50-100 feetor 
so) to listen to the audio. Now walk __ 
around the house tapping the walls, 
rattling objects, or talking in anormal 
. voice, while listening for an increase __ 
in volume level. Make your rattling 
sounds appear as natural as possible, 


98,0000 MHz 
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30 


3kHz RES 


OdB ATT 
dB 2 MHZ/DIV 98.0000 MHz 


1 SEC 
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_ so that the ‘bad guys’ don'tbecome —_ 0 heer 
‘suspicious. If the bugis inthe kitch- 0aB AIT b _ TSEC 
en, then as you move from the living _ dB _ 2 MHZ/DIV 98.0000 MHz 8 kHz RES 


“room into the kitchen, the bug will 
pick up more audio thereby transmit- 
ting a higher-amplitude signal. Youll 


_ hear that over your headphones. 
_ The receiver option of your spec-an 
_will undoubtedly have a ‘speak ° 


tains the integrity ‘of the receiver! The 


audio is re-directed (using shielded. 


coaxial-cable) from the speaker to.a 
set of headphones. Figure 4 shows the 
author’s home-built adaptor box. Al- 
ternatively, a set of cordless infrared 
headphones, such as Maxon’s model 
49-SA can be used, which would not 
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0dB AIT c 


1 SEC 


only ae es elude Sys oo FIG. 2A SPECTRUM ANALYZER WILL INTERCEPT THE BUGS FREQUENCY. In (a), the 

_ ping over a long headphone cord; but aadcast (88-108MHz) FM spectrum is scanned and stored. In (b), the stored spectrumis 

_ they are also useful in detecting in- digitally inverted. In (c), the bugs Frequency sticks out like a sore thumb whent the eee : 
2 tard ee | those exist, toot ee begins Fensong: : ee 
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SPEAKER AUDIO remove my guardianship?” The hus-_ 
‘KGBIO 3 ane To band would then stand to become the. 
AMP 7 2 aaa i amas SCOPE OR ADF trustee to three-million smackers. _ 
The author and out-of-state detec- 


Soe nn an Ye" JACK TO tive set up a spectrum: analyzer, and > 
ER'S RECORDER io sis 
RECEIVER OPTION 2p proceeded to search for a radio signal _ 
that shouldn’t be there, After an hour 
AUDIO a 2 et a or so, an intermittent signal kept pop- 
SPEAKER 7 ote * : te ping up in the middle of the FM- 
3 | lt PHONE JACK fg band: hat didn’ \ 
CLOSED CIRCUIT FOR STEREO roadcast band that didn’t correlate _ 
4 CONDUCTOR EARPHONES-ONLY with any known or published local _ 
iL radio-stations in the area. Without go- 


ing into detail, it was established thal 
HEADPHONE AUDIO 


HEADPHONES 


PHONE JACK Ji 


PHONE PLUG 
Lt 


TO 
SPEAKER ~ 


selectively ‘transmitted inlosioa 
on numerous frequencies. The pur 
pose was to make it much more diffi- 
cult for someone, to locate the bug | 


because it would continually “hop” 
FIG: 3—-USE HEADPHONES FOR LISTENING TO THE BUG’S TRANSMISSIONS. In (a), this to anew frequency. If such a signal is 
circuit will modify your receiver's speaker output for headphone use only. As shown in (b) ered inate fieau al 
, when the phone plug is inserted, the closed-circuit spring apens, thereby cutting offthe . Monitored ON a single oe a 
speakers while re-directing the audio to the » headphones. oe that is heard is gibberish. 


The headphone adaptor box can be covered to be an AC ae cae 
_ attached with Velcro tape to the side _rier transmitter that could activate or 
of the spec-an. In addition to provid- _disable the bug from a convenient lo- _ 
ing headphone-only audio, J2 can in- cation in the neighborhood. Now that __ 
put to a Voice Operated Transmit you have found something as insid- 
(VOX) actuated tape-recorder, J3. can -_ ious as that, whatdo youdo? Psychol- __ 
input to an oscilloscope, Automatic — ogy is always the best weapon. If we _ 
Direction Finder (ADF), or whatever. were to rip the bug out, the “bad _ 
_ else is required. Note: Use only a 1/4" guys” would instantly know. that it 
stereo phone-plug for audio-jack JI, was found. 
that’s because if a monophonic The author ade a honwcen _ 
THE AUTHOR'S home-built — phone-plug is inserted, it will short- note, showed it to.the parties in- 
ae box with either a pair of stereo circuit the audio amplifier. ‘volved, and instructed them to walk 
2 miter san iets infrared trans: outside onto the patio where their 
An actual bust oe conversation could not be overheard. 
_ Asa case in point, the ator! sser- There he informed the victim that she. 
vices were requested by an out-of was neither paranoid nor insane, and 
state detective agency, They hadacli- she immediately fell into the author's __ 
ent who quite honestly thought she arms, crying in relief. The author ad- 7 
_ was losing her mind, 


guardian as a trustee. (Nota bad: situa- (at aiiiel residence) 
tion for the legal guardian.) To her, it = screaming and carrying on, as if 
“seemed that every single word she “something terrible was happening. : 

said inside her home, or over the The next step of the plan was to take 

phone, was somehow being over the children and place them in some- 

heard. No one could find any clan- one else’s custody, whose testimony 

destine listening device, and her and verification could not be oop 
FIG. 5—HERE’S YOUR PERFECT suspicions seemed to be getting the _ in a court of law. s 
See eee eee onence outek: best of her. She thought, ‘Is my ex- Having done that, she should stay 
ing box, and headphone audio-adaptor to husband trying to collect evidence to —_in her house alone, play back the tape 
listen privately to clandestine transmis- _ prove that I’m an unfit. mother, and as loud as possible, grab a few pots 
sions. then use that as a tactic in court to. and pans and make as much noise as 
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‘possible pamtaying a scene of total 
‘chaos and child abuse). The. whole — 
‘purpose of that action was to find out» 


who would show u x 
Well, it worked! It was the in- n-laws 
(outlaws) that showed up, and not the 
husband 


‘orrected.. But if you don’ t-correct it, 
“that. leakage will ruin your day! — 


Spectrum analyzer RF jeakase can 


b cured by making sure that the front 


and rear mounting bezels make good — 


contact with the case. Dissimilar met- 
als should not be used, because. ox- 
ides caused by the bi- metallic contact 


will form a resistive film that isolates: 


the bezel from the chassis. That turns 
the bezel-and aluminum case into an 
_antenna which, in turn, s adiates all of 
the internal RF of the ao c-an’s cit 
_ cuitry. ‘Also make sure t t your plot- 
ter is line-filtered so that RF energy 
. emitted by its microptocessor circuit- 
a ot radiated into the power line: 


RF direction: Roding : 
‘Sometimes clandestine, spurious 
or overbearing emissions can be so 
owerful that they cause problems 
many miles from their source. Enter 
the automatic direction-finding sys- 


tem ‘manufactured ee ro Pre Sys-". 
P 


tached by. Velero a the pas top of 


ates the bearing to the’ RF source, 
while a 7- -segment LED- display indi- 
Cates the bearing in large numerals, 
The Doppler system has a frequency 

-tange of 27 MHz to 500 MHz, and 
‘can be connected to any “standard 
-VHE or UHF FM-receiver. No re- 
ceiver modifications are required— 
- simply. plug the Doppler electronics 
into the receiver's antenna and exter- 


shown in 1 Fig. 6, four.44- -wave 


‘much to the ‘Surprise of ev-- 
an only presume that they _ 
e about. the three- OH a 


ae whip antennas can be mounted ona 


car’s roof for mobile operation, or on 


__ the roof of a house. The antennas can 
electronically simulate a rotating di- 

rectional-antenna. As the antenna © 

moves toward the RF source, the ap- 

~ parent signal frequency increases; as 


the antenna’ moves away from the 


source, the apparent signal frequency 
decreases. That up-down (Doppler). 
: frequency shift is' detected by the FM 
-receiver.as a 300-Hz audio tone. The 
phase of the tone is related to the 
~ bearing angle andis used by the direc- 
» tion-finder electronics to compute and 


display the bearing. 


The purpose of the direction- find- 
ing platform is to get an initial bearing . - 


tothe desired signal, and the relative 
signal strength. The /4-wave whip an- 
tennas must be tuned to the exact fre- 
quency of the clandestine transmis- 
sions.’ You know’ the exact frequency 
by: using:.the: spectrum analyzer. The 


antennas ‘are: collapsible and will .al- \. 


low tuning by. extension-retraction, 
and spacing the bases by sliding them 
along the platform. To work properly, 


- the antennas must be spaced approxi- 
mately /%4-wavelength apart. 


One of the capabilities of a spec- 


~~ trum analyzer is the ability to identify 
~ the frequency of the offending radio- 
he spec-an. The circle of LEDs indi- 


emission: That includes spurious 


- emissions that’ are common in areas 


where multiple transmitters are 


-placed.in close proximity..with each 


other. Besides the non-linear mixing 


~ that occurs ina transmitter’s. final- 
amplifier (called intermodulation) 


that create strong spurious signals, 


other far more exotic kinds. of hetero- ae 


dyning also-occur. 
One time the author found a “dif 


ference” frequency coming from an 
oxidized dome of a town hall. ‘There. . 


ae ere two AM- broadcast stations less ie 


‘than a mile away; one was on 1590 
kHz and the other on 900 kHz. Within — 


a half mile of the town hall, everyone 
in town could hear one of the stations - 
at 690 kHz! That was caused by rec- 


tification from the dome’ 8 SOPH OAS oe 


ide layer. 


When.“ ‘DEing” a spurious Sent Wee 


in a moving vehicle, it is absolutely © 
unperative that you have an assistant, 
or navigator to read a road map and ~ 


= give directions, or-more important— 
to prevent you from kissing a tele- 


phone pole. Using Doppler System’s . 
Automatic’ Direction Finder (ADF), 


the author has been able to track down 


signals to a specific section of a 


house-—from the Foad out front! 


Proximity signals 
If you ‘narrow. down a ‘suspected 
transmitter to within a given area, 
here’s one method of determining its 
proximity. Place three identical anten-. 
na’s having identical lengths (and 
types) of coaxial cable connected to a 


--coaxial-switch box: Use the best. 


coax, like RG 223-U coaxial cable, 


which is double-shielded (98% each) 
~ silver-plated (both. shields and center- 
__ conductor) cable to ensure total integ- 
~rity of the received signal. That may 


sound like overkill, but if you’re go- - 


“ing to do something, why not do it” 


right? oe 
Separate the three antennas by.” 


~ about 30 feet. A low-powered bug will: : 
. show: a. marked. change in’ signal: 
“strength on the spec-an, when anten-: 
nas are independently selected. The 
stronger signal will indicate the -rela-= 
~ tive bearing of the transmitter’s loca- - 


tion. Transmissions from far away 


will indicate. almost E entcd signal - 


teas Se Be 


